CVE-2026-61466

The record

In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the `scope` value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at registration time. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Affected packages

Related vulnerabilities

• CVE-2026-77800 ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML… CWE-304
• CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass… CWE-304
• CVE-2026-76207 phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where… CWE-304
• CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-304
• CVE-2026-67351 Serendipity before 2.6.1 contains an authentication context confusion vulnerability where… CWE-304
• CVE-2026-61143 Vulnerability in the Oracle Communications Convergent Charging Controller product of… CWE-304
• CVE-2026-55957 Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm… CWE-304
• CVE-2026-57915 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending… CWE-304